Fix import_url validation for passwords with special characters
Summary
Fixes #343452 (closed)
Special characters (#, ?, /) in the password portion of an import_url caused "URI is invalid" errors when creating or updating projects via the API.
Changes
Gitlab::UrlSanitizer.valid?: Strip userinfo (credentials) from the URL before passing toAddressable::URI.parse, so special characters in the password don't break parsing.Import::ValidateRemoteGitEndpointService: UseUrlSanitizerto safely extract credentials from the URL instead of rawAddressable::URI.parse. Percent-encode credentials before passing to Gitaly.
Screenshots
| before | after |
|---|---|
![]() |
![]() |
How to verify
- Create a private repo on a GitLab instance with a user whose password contains
#(or any combination of special characters) - Import it via the API:
"import_url": "https://user:pass#word@host/repo.git" - Before fix: 422 error. After fix: project created successfully.
Edited by Carla Drago

